Deployment Architecture

Splunk forwarder on OSX

New Member


I installed the Splunk forwarder on OSX 10.9.1 and started the app, which too me to a web page localhost:8000 which failed to load any thing in the browser. I have trawled the splunk docs to find the manual process and run the following command as root

/Applications/Splunk/bin/splunk add forward-server [Splunk server]:9997

When it asks for the splunk username and password I put in the login for my Splunk server, which is working fine and has 2 PC splunk forwarders connected, but I get a "login failed" response.

Should I just install the full Splunk install and create a forwarder in that.

We have an enterprise license.

Thanks in advance

Tags (2)
0 Karma


The credentials are for the local Splunk forwarder, not your Splunk server. If you didn't change these the default values are "admin" with the password "changeme".

0 Karma

New Member

Awesome thanks!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!